CMMC Compliance

CMMC Incident Response Plan: Requirements, Testing, and a Free Template

By The Defense Compliance Report Editorial Team · Last reviewed: July 2026· Primary sources verified: July 4, 2026

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We are not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency. This is educational research, not legal, contractual, or compliance advice.

The 30-second version

What does CMMC require for incident response?

Incident Response is one of the 14 control families in NIST SP 800-171 Rev. 2, which contains 110 security requirements in total. CMMC Level 2 maps to all 110 (NIST SP 800-171 Rev. 2). The IR family is the second-smallest — just three requirements — which is exactly why it gets underbuilt and why it generates findings out of proportion to its size.

The three controls, in NIST’s own words:

• IR.L2-3.6.1 — Incident Handling

  “Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.”

  In practice: a real, running capability — not a binder — that covers the full lifecycle and that your people know how to use.

• IR.L2-3.6.2 — Incident Reporting

  “Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.”

  In practice: an incident log, a named list of who you notify inside the company, and a defined list of external authorities — including DoD, when DFARS 252.204-7012 applies.

• IR.L2-3.6.3 — Incident Response Testing

  “Test the organizational incident response capability.”

  In practice: a documented exercise — usually a tabletop — with a date, participants, a scenario, findings, and corrective actions.

Source: NIST SP 800-171 Rev. 2, §3.6.1–3.6.3. CMMC Level 2 currently uses Rev. 2 because 32 CFR Part 170 (§170.14) sets Level 2 requirements to NIST SP 800-171 Rev. 2. NIST published Rev. 3 in May 2024, but do not build to Rev. 3 for CMMC purposes unless and until DoD amends the rule.

The evidence map (what a C3PAO examines, interviews, and tests)

A C3PAO evaluates every requirement using three assessment methods defined in NIST SP 800-171A: examine (review your plan, policies, logs, and records), interview (ask your people how it works), and test (watch the capability operate). The IR family breaks into 14 discrete assessment objectives across the three controls.

Sources: NIST SP 800-171A; CMMC Assessment Guide — Level 2.

Which incident response controls can you put on a POA&M?

This is the single most consequential fact about the IR domain, and almost no page states it. When you self-assess against NIST SP 800-171, you post a score to the Supplier Performance Risk System (SPRS). You start at 110and subtract the weighted value of every requirement you haven’t fully implemented. Two of your three IR controls are worth 5 points each— and they’re not POA&M-eligible.

Source: DoD NIST SP 800-171 Assessment Methodology, v1.2.1; 32 CFR Part 170 §170.21.

The CMMC Program Rule (32 CFR Part 170) allows a conditional Level 2 status only if you score at least 88 of 110 (80%), meet all “critical” requirements, and close every POA&M item within a maximum of 180 days. Because 5-point and 3-point controls are barred from the POA&M, the practical translation is blunt: you cannot certify — not even conditionally — with your incident-handling and incident-reporting controls unimplemented. That reframes the whole “IR is just three small controls” instinct. Two of them are pass/fail gates on your certification. Treat them that way.

The DFARS 252.204-7012 72-hour rule — the part most plans underbuild

Both are straightforward to stage before an incident — but they are not details you want to be discovering after the clock starts. DFARS 252.204-7012 applies to any contract involving Covered Defense Information (CDI) — the DFARS term for controlled technical information and other CUI tied to contract performance. When the clause is in your contract, five duties attach to any reportable cyber incident:

Source: DFARS 252.204-7012, Acquisition.gov; certificate info at public.cyber.mil/eca.

Where do you actually file now? (verified July 2026)

Sources: DC3 DCISE — DIB Cybersecurity reporting; DFARS PGI 204.7303-3. Reporting mechanics change without a rule change — confirm current DC3/DCISE instructions before you file.

The sequence a real incident demands

The instinct after finding ransomware or unauthorized access is to contain and restore fast. That instinct is right operationally, but it collides with your preservation duty. Your plan should encode a preserve-before-you-rebuild discipline:

1. 1Contain or isolate the affected system to limit damage, where it's safe to do so.
2. 2Preserve and protect images of affected systems and relevant monitoring/packet-capture data before destructive remediation.
3. 3Report the incident through the current DC3/DCISE ICF process within 72 hours, when DFARS 252.204-7012 applies.
4. 4Then finish eradication and recovery — while keeping the required evidence intact.

One reassurance worth knowing

Reporting an incident is not, by itself, an admission that you failed. DFARS states that a cyber incident report “shall not, by itself, be interpreted as evidence that the contractor or subcontractor has failed to provide adequate security” or otherwise failed to meet the clause (DFARS 204.7302(d)). Report on time and document honestly — the protection is real, but it doesn’t cover an inaccurate SPRS score, which is where False Claims Act exposure lives. And the CMMC Final Rule did not repeal the cyber clause: DFARS 252.204-7012 remains active and keeps its 72-hour reporting, malicious-software, and preservation duties. Full DFARS 252.204-7012 clause breakdown →

What to put in your CMMC incident response plan

The lifecycle in sections 4–8 follows the four-phase model most practitioners use — Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident Activity — which comes from NIST’s incident-handling guidance, NIST SP 800-61 (updated to Revision 3 in 2025). Note that 800-61 is guidance, not a CMMC requirement — 3.6.1 itself already lists the lifecycle elements you must cover.

The structure above is yours to use. If you’d rather have a readiness partner build it, evidence it, and stand behind it for your assessment, see provider categories below.

Can you use a CMMC incident response plan template?

The structure in the previous section is a working template. The failure mode we see is contractors treating a downloaded document as the deliverable, when the deliverable is the operating capability the document describes. Walk away from any template that:

• claims to be “CMMC compliant” without mapping to 3.6.1 / 3.6.2 / 3.6.3;
• never mentions CUI or CDI;
• omits DFARS 252.204-7012;
• doesn’t identify external reporting authorities;
• has no testing section or after-action report; or
• uses old CMMC 1.0 practice IDs (the “17 domains” model) without a current mapping.

Those aren’t cosmetic gaps — each one is a missing assessment objective.

What a C3PAO actually checks in your incident response domain

The CMMC Assessment Guide — Level 2 confirms the same guide supports both self-assessment and certification assessment, and that your scope has to be defined before the assessment starts. Here’s what each method looks like in the IR domain.

How to test your plan so 3.6.3 passes

Starter scenarios that map to DIB reality

Your after-action report should capture: date, scenario, participants, systems in scope, the CUI/CDI-impact decision, the reporting decision, actions taken, evidence produced, gaps found, corrective actions with owners and due dates, and closure. That document is your 3.6.3 evidence. Need scenarios? CISA publishes free tabletop exercise packages you can adapt.

How incident response differs by CMMC level

Sources: 32 CFR Part 170; FAR 52.204-21; NIST SP 800-172.

Do you need an RPO, MSSP, GRC platform, or C3PAO for incident response?

Find My CMMC Path →Non-sensitive questions only. No CUI, no incident specifics.

What to do if you find a possible incident before your plan is ready

How we built this

We wrote this page the way we write every page — by reading the primary sources ourselves and refusing to state a requirement without one. This is editorial decision support, not legal, contractual, or compliance advice.

What we verified (July 4, 2026):

• NIST SP 800-171 Rev. 2 §3.6.1–3.6.3 — The three IR controls and their text.
• NIST SP 800-171A + CMMC Assessment Guide L2 — The examine/interview/test methods and the 14 assessment objectives.
• DoD Assessment Methodology v1.2.1 + 32 CFR §170.21 — The 5/5/1 point values and the rule that 5-point controls can't be POA&M'd.
• DFARS 252.204-7012 (Acquisition.gov + eCFR) — The 72-hour deadline, medium assurance cert, DC3 malware submission, 90-day preservation.
• DC3 DCISE + DFARS PGI 204.7303-3 — DIBNet retired June 6, 2025; reporting moved to DC3/DCISE ICF.
• DFARS 204.7302(d) — A report is not, by itself, evidence of a security failure.
• 32 CFR §170.4 + §170.9 — C3PAO conflict-of-interest rules.
• Federal Register + 32 CFR Part 170 — Level 2 uses NIST SP 800-171 Rev. 2; rule timing; Phase 1 through Nov. 9, 2026; Phase 2 begins Nov. 10, 2026.

Frequently asked questions